We definitely weren't buying in at $5k, but didn't like the LDAP alternative.<div>Thanks for the additional perspective. I'm looking forward now to engaging </div><div>the vendor.</div><div> - Michael</div><div>
<br><div class="gmail_quote">On Tue, Jul 17, 2012 at 10:36 AM, Curry, Warren <span dir="ltr"><<a href="mailto:whcurry@ufl.edu" target="_blank">whcurry@ufl.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">We had a case where the initial estimate by a vendor for one of the UF division was to charge them 11K .
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">After a face to face meeting with the vendor , the division needing /purchasing the service and the IAM office the amount came down to a ˝ day charge for setup
of some scripts and minor custom delta to the install script. Total cost about $500. Still seemed high but it was palatable. The vendors are simply charging based on what they think you might pay based on gross overestimates of the time it takes to implement.
In fact it may even be simpler to implement in SAML in some cases. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Be tuff and don’t just give your money away. I had to help our people in the PPD division and ask the vendor direct question involving what they were being
charged for. First I had them admit the supported SAML authentication. I then followed then what will you be doing for several days of extra install and service fees. Can we see the list of tasks to be done in addition to the tasks you will not need to
do for an LDAP based install. They in this case relented and got reasonable. I was not convinced they needed to charge anything but we moved them from $11,000 to $500.
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Stay the course..
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Warren
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> [mailto:<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>]
<b>On Behalf Of </b>Michael Hodges<br>
<b>Sent:</b> Tuesday, July 17, 2012 2:03 PM</span></p><div><div class="h5"><br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: Non Incommon SPs<u></u><u></u></div></div><p></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Their rationale in our case has been based on the need to defray the costs to deploy custom code to support us (even though we are not their first). The fact that we aren't their first deployment fueled my initial skepticism since how
many hours could a 2nd or 3rd (or higher) custom deployment really entail? This is a one time charge BTW.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">The feedback here is much appreciated; I'm ready to get back into the ring and negotiate this some more.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"> - Michael<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Tue, Jul 17, 2012 at 3:35 AM, Ann West <<a href="mailto:awest@internet2.edu" target="_blank">awest@internet2.edu</a>> wrote:<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">$5K is substantially more than what the top tier Corporate Participant (revenue of $1 B USD) pays per year for InCommon participation. Is that per year or one time, Michael.<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><u></u> <u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">If they are asking every InCommon Participant to pay that cost, they could be making a pretty penny that far exceeds their membership fees. <u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">Ann<u></u><u></u></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:10.0pt;font-family:"Arial","sans-serif"">
<hr size="2" width="100%" align="center">
</span></div>
<div>
<div>
<blockquote style="border:none;border-left:solid #1010ff 1.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif"">And I'm indeed dealing with an academic publisher; I suppose I should be a little less miffed.<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif"">Thanks for the feedback.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"Helvetica","sans-serif""> - Michael<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif"">On Mon, Jul 16, 2012 at 8:08 PM, Nicole Harris <<a href="mailto:nicole@shibboleth.net" target="_blank">nicole@shibboleth.net</a>> wrote:<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif"">Passing subscription charges for federation services back on to the institution is certainly behaviour I've seen from academic publishers, although it is often not as explicit it as this,
just wrapped up in the service cost. I'd say it would be unusual for most commercial vendors NOT to recoup federation fees from IdPs as part of their business model. I guess you could argue that at least these guys are being completely upfront about it and
not just hiding it in their product costs :-) <u></u><u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif""><br>
On 17/07/2012 01:25, Michael Hodges wrote: <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif"">Somewhat related to this thread, I'm dealing with a vendor that *is* an InCommon member, but they are requesting a $5k premium for supporting with our IdP rather than directly accessing
our LDAP server (have they no shame!). Has anyone run across this scenario? I've pushed back since it's hard to consider this to be a reasonable additional cost, but haven't yet prevailed.
<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif""><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"Helvetica","sans-serif""> - Michael<u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif"">On Mon, Jul 16, 2012 at 2:05 PM, Bryan E. Wooten <<a href="mailto:bryan.wooten@utah.edu" target="_blank">bryan.wooten@utah.edu</a>> wrote:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif"">Thank you all for the feedback. I don't know if it confirmation bias or not. But this type a quick response is what makes me a proponent of the open source (especially in Higher Ed) community.
I would never expect this response from any of the "big" vendors. I thank you.<br>
<br>
I am sure most of us deal with this level of conflict on a daily basis.<br>
<br>
We all know that funding is an issue and I feel it is my responsibility to push back at vendors. This won't be the first or last. For me this is the 3rd HR / recruitment vendor I have had the pleasure of dealing with relating to SSO. Even an Incommon can't
do it right. Sigh.<br>
<br>
They all fail.<br>
<br>
Best Regards.<br>
<br>
Bryan<br>
________________________________________<br>
From: <a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> [<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>] on behalf of Cantor, Scott [<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>]<br>
Sent: Monday, July 16, 2012 5:18 PM<br>
To: Shib Users<br>
Subject: Re: Non Incommon SPs<u></u><u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif""><br>
On 7/16/12 7:01 PM, "Bryan E. Wooten" <<a href="mailto:bryan.wooten@utah.edu" target="_blank">bryan.wooten@utah.edu</a>> wrote:<br>
><br>
>What are the steps we can make to make this possible? Do we require they<br>
>provide us with their SP's metadata or can we create that on our own. I<br>
>am also not sure about certificate exchange for SAML assertions.<br>
<br>
If you care, and if you decide you need to encrypt data to them, then<br>
you'll have to have a way to verify their key. They will not understand<br>
what you mean, or why you care, but that's life. You can save some trouble<br>
by not bothering with a key on their end if you can live with the data in<br>
the clear in the messages.<br>
<br>
You may also, based on the eduPerson comment, have to create custom<br>
attribute encodings (or maybe even definitions) in your resolver, which is<br>
a significant change.<br>
<br>
>Any idea the level of effort we will need to make this happen (man hours)?<br>
<br>
There are too many variables to answer that. It can take me minutes to<br>
several hours or even longer if I'm busy debugging their implementation,<br>
pen-testing it, finding bugs, sitting on phone calls explaining to them<br>
why their code is broken. Not that I've ever done that.<br>
<br>
A lot of this comes down to whose data it is. If it's OSU's, then I have<br>
to care or I'm not doing my job. If it's not, then to be honest, they can<br>
do what they like to protect (or botch the protection of) their own data.<br>
<br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><u></u><u></u></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif""><u></u> <u></u></span></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"Helvetica","sans-serif""><u></u> <u></u></span></p>
<pre>--<u></u><u></u></pre>
<pre>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><u></u><u></u></pre>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"Helvetica","sans-serif""><u></u> <u></u></span></p>
</div>
</div>
<pre><span style="color:#888888">-- <u></u><u></u></span></pre>
<pre><span style="color:#888888">Shibboleth Consortium Manager<u></u><u></u></span></pre>
<pre><span style="color:#888888">5 Lancaster Place<u></u><u></u></span></pre>
<pre><span style="color:#888888">London WC2E 7EN <u></u><u></u></span></pre>
</div>
</div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif""><u></u> <u></u></span></p>
</div>
<p class="MsoNormal"><span style="font-family:"Helvetica","sans-serif""><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><u></u><u></u></span></p>
</blockquote>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif""><u></u> <u></u></span></p>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#888888"><br>
<br>
-- <u></u><u></u></span></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#888888">Ann West<br>
Assistant Director,<br>
Assurance and Community<br>
Internet2/InCommon/Michigan Tech <br>
<a href="mailto:awest@internet2.edu" target="_blank">awest@internet2.edu</a> <br>
office: <a href="tel:%2B1.906.487.1726" target="_blank">+1.906.487.1726</a> <u></u>
<u></u></span></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div></div></div>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
<br></blockquote></div><br></div>